Upgrading cryptography 41 to 42
Breaking41.0.7 → 42.0.8Breaking3Security4Deprecated2New11Changed6Fixed8
SecurityLimits the number of name constraint checks performed in X.509 path validation to protect against denial of service attacks.Advisory ↗
BreakingUpgrade verdict
3 breaking changes and 4 security fixes.
In plain terms
- Older LibreSSL libraries are no longer supported.
- SSH certificates with malformed critical options are now rejected.
- Code that loaded empty PKCS7 files and expected an empty list will now get an error.
- Certificate path validation now caps how many name constraint checks it performs, so a malicious certificate cannot make validation take excessive time.
Must act Top 5 of 9 that need code or config changes
What you must change
Breaking3
Drops support for LibreSSL versions older than 3.7.
Parsing SSH certificates no longer permits malformed critical options with values.
Loading a PKCS7 with no content field now raises ValueError instead of returning an empty list.
load_pem_pkcs7_certificatesload_der_pkcs7_certificatesSecurity4
Limits the number of name constraint checks performed in X.509 path validation to protect against denial of service attacks.
cryptography.x509.verificationFixes a null-pointer-dereference and segfault that could occur when creating a PKCS#12 bundle.
High · CVSS 7.5Null pointer dereference in PKCS12 parsing
Medium · CVSS 5.5Python Cryptography package vulnerable to Bleichenbacher timing oracle attack
High · CVSS 7.5Deprecations to plan for
Deprecated2
Deprecates naive datetime properties in favor of the new timezone-aware variants.
Certificate.not_valid_beforeCertificate.not_valid_afterRevokedCertificate.revocation_dateCertificateRevocationList.next_updateCertificateRevocationList.last_updateAnnounces that loading an X.509 certificate with a negative serial number will raise in 43.0.0.
API changes
Generated by DepDelta from published Python source. Not mixed with prose notes.
- changed:
constructor InternalError(msg: str, err_code: typing.List[rust_openssl.OpenSSLError]) -> None → constructor InternalError(msg: str, err_code: list[rust_openssl.OpenSSLError]) -> None - changed:
constructor UnsupportedAlgorithm(message: str, reason: typing.Optional[_Reasons]=…) -> None → constructor UnsupportedAlgorithm(message: str, reason: _Reasons | None=…) -> None
- changed:
constructor Fernet(key: typing.Union[bytes, str], backend: typing.Any=…) -> None → constructor Fernet(key: bytes | str, backend: typing.Any=…) -> None - changed:
method Fernet.decrypt(token: typing.Union[bytes, str], ttl: typing.Optional[int]=…) -> bytes → method Fernet.decrypt(token: bytes | str, ttl: int | None=…) -> bytes - changed:
method Fernet.decrypt_at_time(token: typing.Union[bytes, str], ttl: int, current_time: int) -> bytes → method Fernet.decrypt_at_time(token: bytes | str, ttl: int, current_time: int) -> bytes - changed:
method Fernet.extract_timestamp(token: typing.Union[bytes, str]) -> int → method Fernet.extract_timestamp(token: bytes | str) -> int - changed:
method MultiFernet.decrypt(msg: typing.Union[bytes, str], ttl: typing.Optional[int]=…) -> bytes → method MultiFernet.decrypt(msg: bytes | str, ttl: int | None=…) -> bytes - changed:
method MultiFernet.decrypt_at_time(msg: typing.Union[bytes, str], ttl: int, current_time: int) -> bytes → method MultiFernet.decrypt_at_time(msg: bytes | str, ttl: int, current_time: int) -> bytes - changed:
method MultiFernet.rotate(msg: typing.Union[bytes, str]) -> bytes → method MultiFernet.rotate(msg: bytes | str) -> bytes
- removed:
method Backend.create_cmac_ctx(algorithm: BlockCipherAlgorithm) -> _CMACContext - removed:
method Backend.derive_elliptic_curve_private_key(private_value: int, curve: ec.EllipticCurve) -> ec.EllipticCurvePrivateKey - removed:
method Backend.dh_parameters_supported(p: int, g: int, q: typing.Optional[int]=…) -> bool - removed:
method Backend.ed25519_generate_key() -> ed25519.Ed25519PrivateKey - removed:
method Backend.ed25519_load_private_bytes(data: bytes) -> ed25519.Ed25519PrivateKey - removed:
method Backend.ed25519_load_public_bytes(data: bytes) -> ed25519.Ed25519PublicKey - removed:
method Backend.ed448_generate_key() -> ed448.Ed448PrivateKey - removed:
method Backend.ed448_load_private_bytes(data: bytes) -> ed448.Ed448PrivateKey - removed:
method Backend.ed448_load_public_bytes(data: bytes) -> ed448.Ed448PublicKey - removed:
method Backend.generate_dh_parameters(generator: int, key_size: int) -> dh.DHParameters - removed:
method Backend.generate_dh_private_key(parameters: dh.DHParameters) -> dh.DHPrivateKey - removed:
method Backend.generate_dh_private_key_and_parameters(generator: int, key_size: int) -> dh.DHPrivateKey - removed:
method Backend.generate_dsa_parameters(key_size: int) -> dsa.DSAParameters - removed:
method Backend.generate_dsa_private_key(parameters: dsa.DSAParameters) -> dsa.DSAPrivateKey - removed:
method Backend.generate_dsa_private_key_and_parameters(key_size: int) -> dsa.DSAPrivateKey - removed:
method Backend.generate_elliptic_curve_private_key(curve: ec.EllipticCurve) -> ec.EllipticCurvePrivateKey - removed:
method Backend.generate_rsa_private_key(public_exponent: int, key_size: int) -> rsa.RSAPrivateKey - removed:
method Backend.load_der_parameters(data: bytes) -> dh.DHParameters - removed:
method Backend.load_der_pkcs7_certificates(data: bytes) -> typing.List[x509.Certificate] - removed:
method Backend.load_der_private_key(data: bytes, password: typing.Optional[bytes], unsafe_skip_rsa_key_validation: bool) -> PrivateKeyTypes - removed:
method Backend.load_der_public_key(data: bytes) -> PublicKeyTypes - removed:
method Backend.load_dh_parameter_numbers(numbers: dh.DHParameterNumbers) -> dh.DHParameters - removed:
method Backend.load_dh_private_numbers(numbers: dh.DHPrivateNumbers) -> dh.DHPrivateKey - removed:
method Backend.load_dh_public_numbers(numbers: dh.DHPublicNumbers) -> dh.DHPublicKey - removed:
method Backend.load_dsa_parameter_numbers(numbers: dsa.DSAParameterNumbers) -> dsa.DSAParameters - removed:
method Backend.load_dsa_private_numbers(numbers: dsa.DSAPrivateNumbers) -> dsa.DSAPrivateKey - removed:
method Backend.load_dsa_public_numbers(numbers: dsa.DSAPublicNumbers) -> dsa.DSAPublicKey - removed:
method Backend.load_elliptic_curve_private_numbers(numbers: ec.EllipticCurvePrivateNumbers) -> ec.EllipticCurvePrivateKey - removed:
method Backend.load_elliptic_curve_public_bytes(curve: ec.EllipticCurve, point_bytes: bytes) -> ec.EllipticCurvePublicKey - removed:
method Backend.load_elliptic_curve_public_numbers(numbers: ec.EllipticCurvePublicNumbers) -> ec.EllipticCurvePublicKey - removed:
method Backend.load_pem_parameters(data: bytes) -> dh.DHParameters - removed:
method Backend.load_pem_pkcs7_certificates(data: bytes) -> typing.List[x509.Certificate] - removed:
method Backend.load_pem_private_key(data: bytes, password: typing.Optional[bytes], unsafe_skip_rsa_key_validation: bool) -> PrivateKeyTypes - removed:
method Backend.load_pem_public_key(data: bytes) -> PublicKeyTypes - removed:
method Backend.load_rsa_private_numbers(numbers: rsa.RSAPrivateNumbers, unsafe_skip_rsa_key_validation: bool) -> rsa.RSAPrivateKey - removed:
method Backend.load_rsa_public_numbers(numbers: rsa.RSAPublicNumbers) -> rsa.RSAPublicKey - removed:
method Backend.x25519_generate_key() -> x25519.X25519PrivateKey - removed:
method Backend.x25519_load_private_bytes(data: bytes) -> x25519.X25519PrivateKey - removed:
method Backend.x25519_load_public_bytes(data: bytes) -> x25519.X25519PublicKey - removed:
method Backend.x448_generate_key() -> x448.X448PrivateKey - removed:
method Backend.x448_load_private_bytes(data: bytes) -> x448.X448PrivateKey - removed:
method Backend.x448_load_public_bytes(data: bytes) -> x448.X448PublicKey - changed:
method Backend.load_key_and_certificates_from_pkcs12(data: bytes, password: typing.Optional[bytes]) -> typing.Tuple[typing.Optional[PrivateKeyTypes], typing.Optional[x509.Certificate], typing.List[x509.Certificate]] → method Backend.load_key_and_certificates_from_pkcs12(data: bytes, password: bytes | None) -> tuple[PrivateKeyTypes | None, x509.Certificate | None, list[x509.Certificate]] - changed:
method Backend.load_pkcs12(data: bytes, password: typing.Optional[bytes]) -> PKCS12KeyAndCertificates → method Backend.load_pkcs12(data: bytes, password: bytes | None) -> PKCS12KeyAndCertificates - changed:
method Backend.openssl_assert(ok: bool, errors: typing.Optional[typing.List[rust_openssl.OpenSSLError]]=…) -> None → method Backend.openssl_assert(ok: bool, errors: list[rust_openssl.OpenSSLError] | None=…) -> None - changed:
method Backend.serialize_key_and_certificates_to_pkcs12(name: typing.Optional[bytes], key: typing.Optional[PKCS12PrivateKeyTypes], cert: typing.Optional[x509.Certificate], cas: typing.Optional[typing.List[_PKCS12CATypes]], encryption_algorithm: serialization.KeySerializationEncryption) -> bytes → method Backend.serialize_key_and_certificates_to_pkcs12(name: bytes | None, key: PKCS12PrivateKeyTypes | None, cert: x509.Certificate | None, cas: list[_PKCS12CATypes] | None, encryption_algorithm: serialization.KeySerializationEncryption) -> bytes
- changed:
function build_conditional_library(lib: typing.Any, conditional_names: typing.Dict[str, typing.Callable[[], typing.List[str]]]) -> typing.Any → function build_conditional_library(lib: typing.Any, conditional_names: dict[str, typing.Callable[[], list[str]]]) -> typing.Any
- removed:
class DHParameterNumbers - removed:
class DHPrivateNumbers - removed:
class DHPublicNumbers - removed:
constructor DHParameterNumbers(p: int, g: int, q: typing.Optional[int]=…) -> None - removed:
constructor DHPrivateNumbers(x: int, public_numbers: DHPublicNumbers) -> None - removed:
constructor DHPublicNumbers(y: int, parameter_numbers: DHParameterNumbers) -> None - removed:
function generate_parameters(generator: int, key_size: int, backend: typing.Any=…) -> DHParameters - removed:
method DHParameterNumbers.parameters(backend: typing.Any=…) -> DHParameters - removed:
method DHPrivateNumbers.private_key(backend: typing.Any=…) -> DHPrivateKey - removed:
method DHPublicNumbers.public_key(backend: typing.Any=…) -> DHPublicKey - removed:
property DHParameterNumbers.g -> int - removed:
property DHParameterNumbers.p -> int - removed:
property DHParameterNumbers.q -> typing.Optional[int] - removed:
property DHPrivateNumbers.public_numbers -> DHPublicNumbers - removed:
property DHPrivateNumbers.x -> int - removed:
property DHPublicNumbers.parameter_numbers -> DHParameterNumbers - removed:
property DHPublicNumbers.y -> int - added:
variable DHParameterNumbers - added:
variable DHPrivateNumbers - added:
variable DHPublicNumbers - added:
variable generate_parameters
- removed:
class DSAParameterNumbers - removed:
class DSAPrivateNumbers - removed:
class DSAPublicNumbers - removed:
constructor DSAParameterNumbers(p: int, q: int, g: int) - removed:
constructor DSAPrivateNumbers(x: int, public_numbers: DSAPublicNumbers) - removed:
constructor DSAPublicNumbers(y: int, parameter_numbers: DSAParameterNumbers) - removed:
method DSAParameterNumbers.parameters(backend: typing.Any=…) -> DSAParameters - removed:
method DSAPrivateNumbers.private_key(backend: typing.Any=…) -> DSAPrivateKey - removed:
method DSAPublicNumbers.public_key(backend: typing.Any=…) -> DSAPublicKey - removed:
property DSAParameterNumbers.g -> int - removed:
property DSAParameterNumbers.p -> int - removed:
property DSAParameterNumbers.q -> int - removed:
property DSAPrivateNumbers.public_numbers -> DSAPublicNumbers - removed:
property DSAPrivateNumbers.x -> int - removed:
property DSAPublicNumbers.parameter_numbers -> DSAParameterNumbers - removed:
property DSAPublicNumbers.y -> int - changed:
method DSAPrivateKey.sign(data: bytes, algorithm: typing.Union[asym_utils.Prehashed, hashes.HashAlgorithm]) -> bytes → method DSAPrivateKey.sign(data: bytes, algorithm: asym_utils.Prehashed | hashes.HashAlgorithm) -> bytes - changed:
method DSAPublicKey.verify(signature: bytes, data: bytes, algorithm: typing.Union[asym_utils.Prehashed, hashes.HashAlgorithm]) -> None → method DSAPublicKey.verify(signature: bytes, data: bytes, algorithm: asym_utils.Prehashed | hashes.HashAlgorithm) -> None - added:
variable DSAParameterNumbers - added:
variable DSAPrivateNumbers - added:
variable DSAPublicNumbers
- removed:
class EllipticCurvePrivateNumbers - removed:
class EllipticCurvePublicNumbers - removed:
constructor EllipticCurvePrivateNumbers(private_value: int, public_numbers: EllipticCurvePublicNumbers) - removed:
constructor EllipticCurvePublicNumbers(x: int, y: int, curve: EllipticCurve) - removed:
function generate_private_key(curve: EllipticCurve, backend: typing.Any=…) -> EllipticCurvePrivateKey - removed:
method EllipticCurvePrivateNumbers.private_key(backend: typing.Any=…) -> EllipticCurvePrivateKey - removed:
method EllipticCurvePublicNumbers.public_key(backend: typing.Any=…) -> EllipticCurvePublicKey - removed:
property ECDSA.algorithm -> typing.Union[asym_utils.Prehashed, hashes.HashAlgorithm] - removed:
property EllipticCurvePrivateNumbers.private_value -> int - removed:
property EllipticCurvePrivateNumbers.public_numbers -> EllipticCurvePublicNumbers - removed:
property EllipticCurvePublicNumbers.curve -> EllipticCurve - removed:
property EllipticCurvePublicNumbers.x -> int - removed:
property EllipticCurvePublicNumbers.y -> int - removed:
property EllipticCurveSignatureAlgorithm.algorithm -> typing.Union[asym_utils.Prehashed, hashes.HashAlgorithm] - changed:
constructor ECDSA(algorithm: typing.Union[asym_utils.Prehashed, hashes.HashAlgorithm]) → constructor ECDSA(algorithm: asym_utils.Prehashed | hashes.HashAlgorithm) - changed:
function get_curve_for_oid(oid: ObjectIdentifier) -> typing.Type[EllipticCurve] → function get_curve_for_oid(oid: ObjectIdentifier) -> type[EllipticCurve] - added:
property ECDSA.algorithm -> asym_utils.Prehashed | hashes.HashAlgorithm - added:
property EllipticCurveSignatureAlgorithm.algorithm -> asym_utils.Prehashed | hashes.HashAlgorithm - added:
variable EllipticCurvePrivateNumbers - added:
variable EllipticCurvePublicNumbers - added:
variable generate_private_key
- changed:
constructor OAEP(mgf: MGF, algorithm: hashes.HashAlgorithm, label: typing.Optional[bytes]) → constructor OAEP(mgf: MGF, algorithm: hashes.HashAlgorithm, label: bytes | None) - changed:
constructor PSS(mgf: MGF, salt_length: typing.Union[int, _MaxLength, _Auto, _DigestLength]) -> None → constructor PSS(mgf: MGF, salt_length: int | _MaxLength | _Auto | _DigestLength) -> None - changed:
function calculate_max_pss_salt_length(key: typing.Union[rsa.RSAPrivateKey, rsa.RSAPublicKey], hash_algorithm: hashes.HashAlgorithm) -> int → function calculate_max_pss_salt_length(key: rsa.RSAPrivateKey | rsa.RSAPublicKey, hash_algorithm: hashes.HashAlgorithm) -> int - added:
property OAEP.algorithm -> hashes.HashAlgorithm - added:
property OAEP.mgf -> MGF - added:
property PSS.mgf -> MGF
- removed:
class RSAPrivateNumbers - removed:
class RSAPublicNumbers - removed:
constructor RSAPrivateNumbers(p: int, q: int, d: int, dmp1: int, dmq1: int, iqmp: int, public_numbers: RSAPublicNumbers) - removed:
constructor RSAPublicNumbers(e: int, n: int) - removed:
method RSAPrivateNumbers.private_key(backend: typing.Any=…, *, unsafe_skip_rsa_key_validation: bool=…) -> RSAPrivateKey - removed:
method RSAPublicNumbers.public_key(backend: typing.Any=…) -> RSAPublicKey - removed:
property RSAPrivateNumbers.d -> int - removed:
property RSAPrivateNumbers.dmp1 -> int - removed:
property RSAPrivateNumbers.dmq1 -> int - removed:
property RSAPrivateNumbers.iqmp -> int - removed:
property RSAPrivateNumbers.p -> int - removed:
property RSAPrivateNumbers.public_numbers -> RSAPublicNumbers - removed:
property RSAPrivateNumbers.q -> int - removed:
property RSAPublicNumbers.e -> int - removed:
property RSAPublicNumbers.n -> int - changed:
function rsa_recover_prime_factors(n: int, e: int, d: int) -> typing.Tuple[int, int] → function rsa_recover_prime_factors(n: int, e: int, d: int) -> tuple[int, int] - changed:
method RSAPrivateKey.sign(data: bytes, padding: AsymmetricPadding, algorithm: typing.Union[asym_utils.Prehashed, hashes.HashAlgorithm]) -> bytes → method RSAPrivateKey.sign(data: bytes, padding: AsymmetricPadding, algorithm: asym_utils.Prehashed | hashes.HashAlgorithm) -> bytes - changed:
method RSAPublicKey.recover_data_from_signature(signature: bytes, padding: AsymmetricPadding, algorithm: typing.Optional[hashes.HashAlgorithm]) -> bytes → method RSAPublicKey.recover_data_from_signature(signature: bytes, padding: AsymmetricPadding, algorithm: hashes.HashAlgorithm | None) -> bytes - changed:
method RSAPublicKey.verify(signature: bytes, data: bytes, padding: AsymmetricPadding, algorithm: typing.Union[asym_utils.Prehashed, hashes.HashAlgorithm]) -> None → method RSAPublicKey.verify(signature: bytes, data: bytes, padding: AsymmetricPadding, algorithm: asym_utils.Prehashed | hashes.HashAlgorithm) -> None - added:
variable RSAPrivateNumbers - added:
variable RSAPublicNumbers
- removed:
class AESOCB3 - removed:
class AESSIV - removed:
class ChaCha20Poly1305 - removed:
constructor AESOCB3(key: bytes) - removed:
constructor AESSIV(key: bytes) - removed:
constructor ChaCha20Poly1305(key: bytes) - removed:
method AESOCB3.decrypt(nonce: bytes, data: bytes, associated_data: typing.Optional[bytes]) -> bytes - removed:
method AESOCB3.encrypt(nonce: bytes, data: bytes, associated_data: typing.Optional[bytes]) -> bytes - removed:
method AESSIV.decrypt(data: bytes, associated_data: typing.Optional[typing.List[bytes]]) -> bytes - removed:
method AESSIV.encrypt(data: bytes, associated_data: typing.Optional[typing.List[bytes]]) -> bytes - removed:
method ChaCha20Poly1305.decrypt(nonce: bytes, data: bytes, associated_data: typing.Optional[bytes]) -> bytes - removed:
method ChaCha20Poly1305.encrypt(nonce: bytes, data: bytes, associated_data: typing.Optional[bytes]) -> bytes - removed:
static method AESOCB3.generate_key(bit_length: int) -> bytes - removed:
static method AESSIV.generate_key(bit_length: int) -> bytes - removed:
static method ChaCha20Poly1305.generate_key() -> bytes - changed:
method AESCCM.decrypt(nonce: bytes, data: bytes, associated_data: typing.Optional[bytes]) -> bytes → method AESCCM.decrypt(nonce: bytes, data: bytes, associated_data: bytes | None) -> bytes - changed:
method AESCCM.encrypt(nonce: bytes, data: bytes, associated_data: typing.Optional[bytes]) -> bytes → method AESCCM.encrypt(nonce: bytes, data: bytes, associated_data: bytes | None) -> bytes - changed:
method AESGCM.decrypt(nonce: bytes, data: bytes, associated_data: typing.Optional[bytes]) -> bytes → method AESGCM.decrypt(nonce: bytes, data: bytes, associated_data: bytes | None) -> bytes - changed:
method AESGCM.encrypt(nonce: bytes, data: bytes, associated_data: typing.Optional[bytes]) -> bytes → method AESGCM.encrypt(nonce: bytes, data: bytes, associated_data: bytes | None) -> bytes - added:
variable AESGCMSIV - added:
variable AESOCB3 - added:
variable AESSIV - added:
variable ChaCha20Poly1305
- removed:
property GCM.tag -> typing.Optional[bytes] - removed:
property ModeWithAuthenticationTag.tag -> typing.Optional[bytes] - changed:
constructor GCM(initialization_vector: bytes, tag: typing.Optional[bytes]=…, min_tag_length: int=…) → constructor GCM(initialization_vector: bytes, tag: bytes | None=…, min_tag_length: int=…) - added:
property GCM.tag -> bytes | None - added:
property ModeWithAuthenticationTag.tag -> bytes | None
- removed:
class CMAC - removed:
constructor CMAC(algorithm: ciphers.BlockCipherAlgorithm, backend: typing.Any=…, ctx: typing.Optional[_CMACContext]=…) -> None - removed:
method CMAC.copy() -> CMAC - removed:
method CMAC.finalize() -> bytes - removed:
method CMAC.update(data: bytes) -> None - removed:
method CMAC.verify(signature: bytes) -> None - added:
variable CMAC
- removed:
property HashAlgorithm.block_size -> typing.Optional[int] - added:
property HashAlgorithm.block_size -> int | None
- changed:
constructor ConcatKDFHMAC(algorithm: hashes.HashAlgorithm, length: int, salt: typing.Optional[bytes], otherinfo: typing.Optional[bytes], backend: typing.Any=…) → constructor ConcatKDFHMAC(algorithm: hashes.HashAlgorithm, length: int, salt: bytes | None, otherinfo: bytes | None, backend: typing.Any=…) - changed:
constructor ConcatKDFHash(algorithm: hashes.HashAlgorithm, length: int, otherinfo: typing.Optional[bytes], backend: typing.Any=…) → constructor ConcatKDFHash(algorithm: hashes.HashAlgorithm, length: int, otherinfo: bytes | None, backend: typing.Any=…)
- changed:
constructor HKDF(algorithm: hashes.HashAlgorithm, length: int, salt: typing.Optional[bytes], info: typing.Optional[bytes], backend: typing.Any=…) → constructor HKDF(algorithm: hashes.HashAlgorithm, length: int, salt: bytes | None, info: bytes | None, backend: typing.Any=…) - changed:
constructor HKDFExpand(algorithm: hashes.HashAlgorithm, length: int, info: typing.Optional[bytes], backend: typing.Any=…) → constructor HKDFExpand(algorithm: hashes.HashAlgorithm, length: int, info: bytes | None, backend: typing.Any=…)
- changed:
constructor KBKDFCMAC(algorithm, mode: Mode, length: int, rlen: int, llen: typing.Optional[int], location: CounterLocation, label: typing.Optional[bytes], context: typing.Optional[bytes], fixed: typing.Optional[bytes], backend: typing.Any=…, *, break_location: typing.Optional[int]=…) → constructor KBKDFCMAC(algorithm, mode: Mode, length: int, rlen: int, llen: int | None, location: CounterLocation, label: bytes | None, context: bytes | None, fixed: bytes | None, backend: typing.Any=…, *, break_location: int | None=…) - changed:
constructor KBKDFHMAC(algorithm: hashes.HashAlgorithm, mode: Mode, length: int, rlen: int, llen: typing.Optional[int], location: CounterLocation, label: typing.Optional[bytes], context: typing.Optional[bytes], fixed: typing.Optional[bytes], backend: typing.Any=…, *, break_location: typing.Optional[int]=…) → constructor KBKDFHMAC(algorithm: hashes.HashAlgorithm, mode: Mode, length: int, rlen: int, llen: int | None, location: CounterLocation, label: bytes | None, context: bytes | None, fixed: bytes | None, backend: typing.Any=…, *, break_location: int | None=…)
- changed:
constructor X963KDF(algorithm: hashes.HashAlgorithm, length: int, sharedinfo: typing.Optional[bytes], backend: typing.Any=…) → constructor X963KDF(algorithm: hashes.HashAlgorithm, length: int, sharedinfo: bytes | None, backend: typing.Any=…)
- removed:
function load_der_parameters(data: bytes, backend: typing.Any=…) -> dh.DHParameters - removed:
function load_der_private_key(data: bytes, password: typing.Optional[bytes], backend: typing.Any=…, *, unsafe_skip_rsa_key_validation: bool=…) -> PrivateKeyTypes - removed:
function load_der_public_key(data: bytes, backend: typing.Any=…) -> PublicKeyTypes - removed:
function load_pem_parameters(data: bytes, backend: typing.Any=…) -> dh.DHParameters - removed:
function load_pem_private_key(data: bytes, password: typing.Optional[bytes], backend: typing.Any=…, *, unsafe_skip_rsa_key_validation: bool=…) -> PrivateKeyTypes - removed:
function load_pem_public_key(data: bytes, backend: typing.Any=…) -> PublicKeyTypes - added:
variable load_der_parameters - added:
variable load_der_private_key - added:
variable load_der_public_key - added:
variable load_pem_parameters - added:
variable load_pem_private_key - added:
variable load_pem_public_key
- removed:
property PKCS12Certificate.friendly_name -> typing.Optional[bytes] - removed:
property PKCS12KeyAndCertificates.additional_certs -> typing.List[PKCS12Certificate] - removed:
property PKCS12KeyAndCertificates.cert -> typing.Optional[PKCS12Certificate] - removed:
property PKCS12KeyAndCertificates.key -> typing.Optional[PrivateKeyTypes] - changed:
constructor PKCS12Certificate(cert: x509.Certificate, friendly_name: typing.Optional[bytes]) → constructor PKCS12Certificate(cert: x509.Certificate, friendly_name: bytes | None) - changed:
constructor PKCS12KeyAndCertificates(key: typing.Optional[PrivateKeyTypes], cert: typing.Optional[PKCS12Certificate], additional_certs: typing.List[PKCS12Certificate]) → constructor PKCS12KeyAndCertificates(key: PrivateKeyTypes | None, cert: PKCS12Certificate | None, additional_certs: list[PKCS12Certificate]) - changed:
function load_key_and_certificates(data: bytes, password: typing.Optional[bytes], backend: typing.Any=…) -> typing.Tuple[typing.Optional[PrivateKeyTypes], typing.Optional[x509.Certificate], typing.List[x509.Certificate]] → function load_key_and_certificates(data: bytes, password: bytes | None, backend: typing.Any=…) -> tuple[PrivateKeyTypes | None, x509.Certificate | None, list[x509.Certificate]] - changed:
function load_pkcs12(data: bytes, password: typing.Optional[bytes], backend: typing.Any=…) -> PKCS12KeyAndCertificates → function load_pkcs12(data: bytes, password: bytes | None, backend: typing.Any=…) -> PKCS12KeyAndCertificates - changed:
function serialize_key_and_certificates(name: typing.Optional[bytes], key: typing.Optional[PKCS12PrivateKeyTypes], cert: typing.Optional[x509.Certificate], cas: typing.Optional[typing.Iterable[_PKCS12CATypes]], encryption_algorithm: serialization.KeySerializationEncryption) -> bytes → function serialize_key_and_certificates(name: bytes | None, key: PKCS12PrivateKeyTypes | None, cert: x509.Certificate | None, cas: typing.Iterable[_PKCS12CATypes] | None, encryption_algorithm: serialization.KeySerializationEncryption) -> bytes - added:
property PKCS12Certificate.friendly_name -> bytes | None - added:
property PKCS12KeyAndCertificates.additional_certs -> list[PKCS12Certificate] - added:
property PKCS12KeyAndCertificates.cert -> PKCS12Certificate | None - added:
property PKCS12KeyAndCertificates.key -> PrivateKeyTypes | None
- removed:
function load_der_pkcs7_certificates(data: bytes) -> typing.List[x509.Certificate] - removed:
function load_pem_pkcs7_certificates(data: bytes) -> typing.List[x509.Certificate] - removed:
function serialize_certificates(certs: typing.List[x509.Certificate], encoding: serialization.Encoding) -> bytes - changed:
constructor PKCS7SignatureBuilder(data: typing.Optional[bytes]=…, signers: typing.List[typing.Tuple[x509.Certificate, PKCS7PrivateKeyTypes, PKCS7HashTypes]]=…, additional_certs: typing.List[x509.Certificate]=…) → constructor PKCS7SignatureBuilder(data: bytes | None=…, signers: list[tuple[x509.Certificate, PKCS7PrivateKeyTypes, PKCS7HashTypes, padding.PSS | padding.PKCS1v15 | None]]=…, additional_certs: list[x509.Certificate]=…) - changed:
method PKCS7SignatureBuilder.add_signer(certificate: x509.Certificate, private_key: PKCS7PrivateKeyTypes, hash_algorithm: PKCS7HashTypes) -> PKCS7SignatureBuilder → method PKCS7SignatureBuilder.add_signer(certificate: x509.Certificate, private_key: PKCS7PrivateKeyTypes, hash_algorithm: PKCS7HashTypes, *, rsa_padding: padding.PSS | padding.PKCS1v15 | None=…) -> PKCS7SignatureBuilder - added:
variable load_der_pkcs7_certificates - added:
variable load_pem_pkcs7_certificates - added:
variable serialize_certificates
- removed:
property SSHCertificate.critical_options -> typing.Dict[bytes, bytes] - removed:
property SSHCertificate.extensions -> typing.Dict[bytes, bytes] - removed:
property SSHCertificate.valid_principals -> typing.List[bytes] - changed:
constructor SSHCertificate(_nonce: memoryview, _public_key: SSHPublicKeyTypes, _serial: int, _cctype: int, _key_id: memoryview, _valid_principals: typing.List[bytes], _valid_after: int, _valid_before: int, _critical_options: typing.Dict[bytes, bytes], _extensions: typing.Dict[bytes, bytes], _sig_type: memoryview, _sig_key: memoryview, _inner_sig_type: memoryview, _signature: memoryview, _tbs_cert… → constructor SSHCertificate(_nonce: memoryview, _public_key: SSHPublicKeyTypes, _serial: int, _cctype: int, _key_id: memoryview, _valid_principals: list[bytes], _valid_after: int, _valid_before: int, _critical_options: dict[bytes, bytes], _extensions: dict[bytes, bytes], _sig_type: memoryview, _sig_key: memoryview, _inner_sig_type: memoryview, _signature: memoryview, _tbs_cert_body: memoryview, _c… - changed:
constructor SSHCertificateBuilder(_public_key: typing.Optional[SSHCertPublicKeyTypes]=…, _serial: typing.Optional[int]=…, _type: typing.Optional[SSHCertificateType]=…, _key_id: typing.Optional[bytes]=…, _valid_principals: typing.List[bytes]=…, _valid_for_all_principals: bool=…, _valid_before: typing.Optional[int]=…, _valid_after: typing.Optional[int]=…, _critical_options: typing.List[typing.Tuple… → constructor SSHCertificateBuilder(_public_key: SSHCertPublicKeyTypes | None=…, _serial: int | None=…, _type: SSHCertificateType | None=…, _key_id: bytes | None=…, _valid_principals: list[bytes]=…, _valid_for_all_principals: bool=…, _valid_before: int | None=…, _valid_after: int | None=…, _critical_options: list[tuple[bytes, bytes]]=…, _extensions: list[tuple[bytes, bytes]]=…) - changed:
function load_ssh_private_key(data: bytes, password: typing.Optional[bytes], backend: typing.Any=…) -> SSHPrivateKeyTypes → function load_ssh_private_key(data: bytes, password: bytes | None, backend: typing.Any=…) -> SSHPrivateKeyTypes - changed:
function load_ssh_public_identity(data: bytes) -> typing.Union[SSHCertificate, SSHPublicKeyTypes] → function load_ssh_public_identity(data: bytes) -> SSHCertificate | SSHPublicKeyTypes - changed:
method SSHCertificateBuilder.valid_after(valid_after: typing.Union[int, float]) -> SSHCertificateBuilder → method SSHCertificateBuilder.valid_after(valid_after: int | float) -> SSHCertificateBuilder - changed:
method SSHCertificateBuilder.valid_before(valid_before: typing.Union[int, float]) -> SSHCertificateBuilder → method SSHCertificateBuilder.valid_before(valid_before: int | float) -> SSHCertificateBuilder - changed:
method SSHCertificateBuilder.valid_principals(valid_principals: typing.List[bytes]) -> SSHCertificateBuilder → method SSHCertificateBuilder.valid_principals(valid_principals: list[bytes]) -> SSHCertificateBuilder - added:
property SSHCertificate.critical_options -> dict[bytes, bytes] - added:
property SSHCertificate.extensions -> dict[bytes, bytes] - added:
property SSHCertificate.valid_principals -> list[bytes]
- changed:
method HOTP.get_provisioning_uri(account_name: str, counter: int, issuer: typing.Optional[str]) -> str → method HOTP.get_provisioning_uri(account_name: str, counter: int, issuer: str | None) -> str
- changed:
method TOTP.generate(time: typing.Union[int, float]) -> bytes → method TOTP.generate(time: int | float) -> bytes - changed:
method TOTP.get_provisioning_uri(account_name: str, issuer: typing.Optional[str]) -> str → method TOTP.get_provisioning_uri(account_name: str, issuer: str | None) -> str
- changed:
function deprecated(value: object, module_name: str, message: str, warning_class: typing.Type[Warning], name: typing.Optional[str]=…) -> _DeprecatedValue → function deprecated(value: object, module_name: str, message: str, warning_class: type[Warning], name: str | None=…) -> _DeprecatedValue - changed:
function int_to_bytes(integer: int, length: typing.Optional[int]=…) -> bytes → function int_to_bytes(integer: int, length: int | None=…) -> bytes - added:
variable DeprecatedIn42
- added:
export verification
- removed:
function load_der_x509_certificate(data: bytes, backend: typing.Any=…) -> Certificate - removed:
function load_der_x509_crl(data: bytes, backend: typing.Any=…) -> CertificateRevocationList - removed:
function load_der_x509_csr(data: bytes, backend: typing.Any=…) -> CertificateSigningRequest - removed:
function load_pem_x509_certificate(data: bytes, backend: typing.Any=…) -> Certificate - removed:
function load_pem_x509_certificates(data: bytes) -> typing.List[Certificate] - removed:
function load_pem_x509_crl(data: bytes, backend: typing.Any=…) -> CertificateRevocationList - removed:
function load_pem_x509_csr(data: bytes, backend: typing.Any=…) -> CertificateSigningRequest - removed:
property Certificate.signature_algorithm_parameters -> typing.Union[None, padding.PSS, padding.PKCS1v15, ec.ECDSA] - removed:
property Certificate.signature_hash_algorithm -> typing.Optional[hashes.HashAlgorithm] - removed:
property CertificateRevocationList.next_update -> typing.Optional[datetime.datetime] - removed:
property CertificateRevocationList.signature_hash_algorithm -> typing.Optional[hashes.HashAlgorithm] - removed:
property CertificateSigningRequest.signature_hash_algorithm -> typing.Optional[hashes.HashAlgorithm] - changed:
constructor CertificateBuilder(issuer_name: typing.Optional[Name]=…, subject_name: typing.Optional[Name]=…, public_key: typing.Optional[CertificatePublicKeyTypes]=…, serial_number: typing.Optional[int]=…, not_valid_before: typing.Optional[datetime.datetime]=…, not_valid_after: typing.Optional[datetime.datetime]=…, extensions: typing.List[Extension[ExtensionType]]=…) -> None → constructor CertificateBuilder(issuer_name: Name | None=…, subject_name: Name | None=…, public_key: CertificatePublicKeyTypes | None=…, serial_number: int | None=…, not_valid_before: datetime.datetime | None=…, not_valid_after: datetime.datetime | None=…, extensions: list[Extension[ExtensionType]]=…) -> None - changed:
constructor CertificateRevocationListBuilder(issuer_name: typing.Optional[Name]=…, last_update: typing.Optional[datetime.datetime]=…, next_update: typing.Optional[datetime.datetime]=…, extensions: typing.List[Extension[ExtensionType]]=…, revoked_certificates: typing.List[RevokedCertificate]=…) → constructor CertificateRevocationListBuilder(issuer_name: Name | None=…, last_update: datetime.datetime | None=…, next_update: datetime.datetime | None=…, extensions: list[Extension[ExtensionType]]=…, revoked_certificates: list[RevokedCertificate]=…) - changed:
constructor CertificateSigningRequestBuilder(subject_name: typing.Optional[Name]=…, extensions: typing.List[Extension[ExtensionType]]=…, attributes: typing.List[typing.Tuple[ObjectIdentifier, bytes, typing.Optional[int]]]=…) → constructor CertificateSigningRequestBuilder(subject_name: Name | None=…, extensions: list[Extension[ExtensionType]]=…, attributes: list[tuple[ObjectIdentifier, bytes, int | None]]=…) - changed:
constructor RevokedCertificateBuilder(serial_number: typing.Optional[int]=…, revocation_date: typing.Optional[datetime.datetime]=…, extensions: typing.List[Extension[ExtensionType]]=…) → constructor RevokedCertificateBuilder(serial_number: int | None=…, revocation_date: datetime.datetime | None=…, extensions: list[Extension[ExtensionType]]=…) - changed:
method CertificateBuilder.sign(private_key: CertificateIssuerPrivateKeyTypes, algorithm: typing.Optional[_AllowedHashTypes], backend: typing.Any=…, *, rsa_padding: typing.Optional[typing.Union[padding.PSS, padding.PKCS1v15]]=…) -> Certificate → method CertificateBuilder.sign(private_key: CertificateIssuerPrivateKeyTypes, algorithm: _AllowedHashTypes | None, backend: typing.Any=…, *, rsa_padding: padding.PSS | padding.PKCS1v15 | None=…) -> Certificate - changed:
method CertificateRevocationList.get_revoked_certificate_by_serial_number(serial_number: int) -> typing.Optional[RevokedCertificate] → method CertificateRevocationList.get_revoked_certificate_by_serial_number(serial_number: int) -> RevokedCertificate | None - changed:
method CertificateRevocationListBuilder.sign(private_key: CertificateIssuerPrivateKeyTypes, algorithm: typing.Optional[_AllowedHashTypes], backend: typing.Any=…) -> CertificateRevocationList → method CertificateRevocationListBuilder.sign(private_key: CertificateIssuerPrivateKeyTypes, algorithm: _AllowedHashTypes | None, backend: typing.Any=…, *, rsa_padding: padding.PSS | padding.PKCS1v15 | None=…) -> CertificateRevocationList - changed:
method CertificateSigningRequestBuilder.add_attribute(oid: ObjectIdentifier, value: bytes, *, _tag: typing.Optional[_ASN1Type]=…) -> CertificateSigningRequestBuilder → method CertificateSigningRequestBuilder.add_attribute(oid: ObjectIdentifier, value: bytes, *, _tag: _ASN1Type | None=…) -> CertificateSigningRequestBuilder - changed:
method CertificateSigningRequestBuilder.sign(private_key: CertificateIssuerPrivateKeyTypes, algorithm: typing.Optional[_AllowedHashTypes], backend: typing.Any=…) -> CertificateSigningRequest → method CertificateSigningRequestBuilder.sign(private_key: CertificateIssuerPrivateKeyTypes, algorithm: _AllowedHashTypes | None, backend: typing.Any=…, *, rsa_padding: padding.PSS | padding.PKCS1v15 | None=…) -> CertificateSigningRequest - added:
property Certificate.not_valid_after_utc -> datetime.datetime - added:
property Certificate.not_valid_before_utc -> datetime.datetime - added:
property Certificate.signature_algorithm_parameters -> None | padding.PSS | padding.PKCS1v15 | ec.ECDSA - added:
property Certificate.signature_hash_algorithm -> hashes.HashAlgorithm | None - added:
property CertificateRevocationList.last_update_utc -> datetime.datetime - added:
property CertificateRevocationList.next_update -> datetime.datetime | None - added:
property CertificateRevocationList.next_update_utc -> datetime.datetime | None - added:
property CertificateRevocationList.signature_algorithm_parameters -> None | padding.PSS | padding.PKCS1v15 | ec.ECDSA - added:
property CertificateRevocationList.signature_hash_algorithm -> hashes.HashAlgorithm | None - added:
property CertificateSigningRequest.signature_algorithm_parameters -> None | padding.PSS | padding.PKCS1v15 | ec.ECDSA - added:
property CertificateSigningRequest.signature_hash_algorithm -> hashes.HashAlgorithm | None - added:
property RevokedCertificate.revocation_date_utc -> datetime.datetime - added:
variable load_der_x509_certificate - added:
variable load_der_x509_crl - added:
variable load_der_x509_csr - added:
variable load_pem_x509_certificate - added:
variable load_pem_x509_certificates - added:
variable load_pem_x509_crl - added:
variable load_pem_x509_csr
- removed:
property AuthorityKeyIdentifier.authority_cert_issuer -> typing.Optional[typing.List[GeneralName]] - removed:
property AuthorityKeyIdentifier.authority_cert_serial_number -> typing.Optional[int] - removed:
property AuthorityKeyIdentifier.key_identifier -> typing.Optional[bytes] - removed:
property BasicConstraints.path_length -> typing.Optional[int] - removed:
property DistributionPoint.crl_issuer -> typing.Optional[typing.List[GeneralName]] - removed:
property DistributionPoint.full_name -> typing.Optional[typing.List[GeneralName]] - removed:
property DistributionPoint.reasons -> typing.Optional[typing.FrozenSet[ReasonFlags]] - removed:
property DistributionPoint.relative_name -> typing.Optional[RelativeDistinguishedName] - removed:
property IssuingDistributionPoint.full_name -> typing.Optional[typing.List[GeneralName]] - removed:
property IssuingDistributionPoint.only_some_reasons -> typing.Optional[typing.FrozenSet[ReasonFlags]] - removed:
property IssuingDistributionPoint.relative_name -> typing.Optional[RelativeDistinguishedName] - removed:
property MSCertificateTemplate.major_version -> typing.Optional[int] - removed:
property MSCertificateTemplate.minor_version -> typing.Optional[int] - removed:
property NameConstraints.excluded_subtrees -> typing.Optional[typing.List[GeneralName]] - removed:
property NameConstraints.permitted_subtrees -> typing.Optional[typing.List[GeneralName]] - removed:
property NoticeReference.notice_numbers -> typing.List[int] - removed:
property NoticeReference.organization -> typing.Optional[str] - removed:
property PolicyConstraints.inhibit_policy_mapping -> typing.Optional[int] - removed:
property PolicyConstraints.require_explicit_policy -> typing.Optional[int] - removed:
property PolicyInformation.policy_qualifiers -> typing.Optional[typing.List[typing.Union[str, UserNotice]]] - removed:
property UserNotice.explicit_text -> typing.Optional[str] - removed:
property UserNotice.notice_reference -> typing.Optional[NoticeReference] - changed:
constructor AuthorityKeyIdentifier(key_identifier: typing.Optional[bytes], authority_cert_issuer: typing.Optional[typing.Iterable[GeneralName]], authority_cert_serial_number: typing.Optional[int]) -> None → constructor AuthorityKeyIdentifier(key_identifier: bytes | None, authority_cert_issuer: typing.Iterable[GeneralName] | None, authority_cert_serial_number: int | None) -> None - changed:
constructor BasicConstraints(ca: bool, path_length: typing.Optional[int]) -> None → constructor BasicConstraints(ca: bool, path_length: int | None) -> None - changed:
constructor DistributionPoint(full_name: typing.Optional[typing.Iterable[GeneralName]], relative_name: typing.Optional[RelativeDistinguishedName], reasons: typing.Optional[typing.FrozenSet[ReasonFlags]], crl_issuer: typing.Optional[typing.Iterable[GeneralName]]) -> None → constructor DistributionPoint(full_name: typing.Iterable[GeneralName] | None, relative_name: RelativeDistinguishedName | None, reasons: frozenset[ReasonFlags] | None, crl_issuer: typing.Iterable[GeneralName] | None) -> None - changed:
constructor IssuingDistributionPoint(full_name: typing.Optional[typing.Iterable[GeneralName]], relative_name: typing.Optional[RelativeDistinguishedName], only_contains_user_certs: bool, only_contains_ca_certs: bool, only_some_reasons: typing.Optional[typing.FrozenSet[ReasonFlags]], indirect_crl: bool, only_contains_attribute_certs: bool) -> None → constructor IssuingDistributionPoint(full_name: typing.Iterable[GeneralName] | None, relative_name: RelativeDistinguishedName | None, only_contains_user_certs: bool, only_contains_ca_certs: bool, only_some_reasons: frozenset[ReasonFlags] | None, indirect_crl: bool, only_contains_attribute_certs: bool) -> None - changed:
constructor MSCertificateTemplate(template_id: ObjectIdentifier, major_version: typing.Optional[int], minor_version: typing.Optional[int]) -> None → constructor MSCertificateTemplate(template_id: ObjectIdentifier, major_version: int | None, minor_version: int | None) -> None - changed:
constructor NameConstraints(permitted_subtrees: typing.Optional[typing.Iterable[GeneralName]], excluded_subtrees: typing.Optional[typing.Iterable[GeneralName]]) -> None → constructor NameConstraints(permitted_subtrees: typing.Iterable[GeneralName] | None, excluded_subtrees: typing.Iterable[GeneralName] | None) -> None - changed:
constructor NoticeReference(organization: typing.Optional[str], notice_numbers: typing.Iterable[int]) -> None → constructor NoticeReference(organization: str | None, notice_numbers: typing.Iterable[int]) -> None - changed:
constructor PolicyConstraints(require_explicit_policy: typing.Optional[int], inhibit_policy_mapping: typing.Optional[int]) -> None → constructor PolicyConstraints(require_explicit_policy: int | None, inhibit_policy_mapping: int | None) -> None - changed:
constructor PolicyInformation(policy_identifier: ObjectIdentifier, policy_qualifiers: typing.Optional[typing.Iterable[typing.Union[str, UserNotice]]]) -> None → constructor PolicyInformation(policy_identifier: ObjectIdentifier, policy_qualifiers: typing.Iterable[str | UserNotice] | None) -> None - changed:
constructor UserNotice(notice_reference: typing.Optional[NoticeReference], explicit_text: typing.Optional[str]) -> None → constructor UserNotice(notice_reference: NoticeReference | None, explicit_text: str | None) -> None - changed:
method CertificateIssuer.get_values_for_type(type: typing.Union[typing.Type[DNSName], typing.Type[UniformResourceIdentifier], typing.Type[RFC822Name]]) -> typing.List[str] | (type: typing.Type[DirectoryName]) -> typing.List[Name] | (type: typing.Type[RegisteredID]) -> typing.List[ObjectIdentifier] | (type: typing.Type[IPAddress]) -> typing.List[_IPAddressTypes] | (type: typing.Type[OtherName]) ->… → method CertificateIssuer.get_values_for_type(type: type[DNSName] | type[UniformResourceIdentifier] | type[RFC822Name]) -> list[str] | (type: type[DirectoryName]) -> list[Name] | (type: type[RegisteredID]) -> list[ObjectIdentifier] | (type: type[IPAddress]) -> list[_IPAddressTypes] | (type: type[OtherName]) -> list[OtherName] - changed:
method Extensions.get_extension_for_class(extclass: typing.Type[ExtensionTypeVar]) -> Extension[ExtensionTypeVar] → method Extensions.get_extension_for_class(extclass: type[ExtensionTypeVar]) -> Extension[ExtensionTypeVar] - changed:
method GeneralNames.get_values_for_type(type: typing.Union[typing.Type[DNSName], typing.Type[UniformResourceIdentifier], typing.Type[RFC822Name]]) -> typing.List[str] | (type: typing.Type[DirectoryName]) -> typing.List[Name] | (type: typing.Type[RegisteredID]) -> typing.List[ObjectIdentifier] | (type: typing.Type[IPAddress]) -> typing.List[_IPAddressTypes] | (type: typing.Type[OtherName]) -> typi… → method GeneralNames.get_values_for_type(type: type[DNSName] | type[UniformResourceIdentifier] | type[RFC822Name]) -> list[str] | (type: type[DirectoryName]) -> list[Name] | (type: type[RegisteredID]) -> list[ObjectIdentifier] | (type: type[IPAddress]) -> list[_IPAddressTypes] | (type: type[OtherName]) -> list[OtherName] - changed:
method IssuerAlternativeName.get_values_for_type(type: typing.Union[typing.Type[DNSName], typing.Type[UniformResourceIdentifier], typing.Type[RFC822Name]]) -> typing.List[str] | (type: typing.Type[DirectoryName]) -> typing.List[Name] | (type: typing.Type[RegisteredID]) -> typing.List[ObjectIdentifier] | (type: typing.Type[IPAddress]) -> typing.List[_IPAddressTypes] | (type: typing.Type[OtherName]… → method IssuerAlternativeName.get_values_for_type(type: type[DNSName] | type[UniformResourceIdentifier] | type[RFC822Name]) -> list[str] | (type: type[DirectoryName]) -> list[Name] | (type: type[RegisteredID]) -> list[ObjectIdentifier] | (type: type[IPAddress]) -> list[_IPAddressTypes] | (type: type[OtherName]) -> list[OtherName] - changed:
method SubjectAlternativeName.get_values_for_type(type: typing.Union[typing.Type[DNSName], typing.Type[UniformResourceIdentifier], typing.Type[RFC822Name]]) -> typing.List[str] | (type: typing.Type[DirectoryName]) -> typing.List[Name] | (type: typing.Type[RegisteredID]) -> typing.List[ObjectIdentifier] | (type: typing.Type[IPAddress]) -> typing.List[_IPAddressTypes] | (type: typing.Type[OtherName… → method SubjectAlternativeName.get_values_for_type(type: type[DNSName] | type[UniformResourceIdentifier] | type[RFC822Name]) -> list[str] | (type: type[DirectoryName]) -> list[Name] | (type: type[RegisteredID]) -> list[ObjectIdentifier] | (type: type[IPAddress]) -> list[_IPAddressTypes] | (type: type[OtherName]) -> list[OtherName] - added:
property AuthorityKeyIdentifier.authority_cert_issuer -> list[GeneralName] | None - added:
property AuthorityKeyIdentifier.authority_cert_serial_number -> int | None - added:
property AuthorityKeyIdentifier.key_identifier -> bytes | None - added:
property BasicConstraints.path_length -> int | None - added:
property DistributionPoint.crl_issuer -> list[GeneralName] | None - added:
property DistributionPoint.full_name -> list[GeneralName] | None - added:
property DistributionPoint.reasons -> frozenset[ReasonFlags] | None - added:
property DistributionPoint.relative_name -> RelativeDistinguishedName | None - added:
property IssuingDistributionPoint.full_name -> list[GeneralName] | None - added:
property IssuingDistributionPoint.only_some_reasons -> frozenset[ReasonFlags] | None - added:
property IssuingDistributionPoint.relative_name -> RelativeDistinguishedName | None - added:
property MSCertificateTemplate.major_version -> int | None - added:
property MSCertificateTemplate.minor_version -> int | None - added:
property NameConstraints.excluded_subtrees -> list[GeneralName] | None - added:
property NameConstraints.permitted_subtrees -> list[GeneralName] | None - added:
property NoticeReference.notice_numbers -> list[int] - added:
property NoticeReference.organization -> str | None - added:
property PolicyConstraints.inhibit_policy_mapping -> int | None - added:
property PolicyConstraints.require_explicit_policy -> int | None - added:
property PolicyInformation.policy_qualifiers -> list[str | UserNotice] | None - added:
property UserNotice.explicit_text -> str | None - added:
property UserNotice.notice_reference -> NoticeReference | None
- removed:
property Name.rdns -> typing.List[RelativeDistinguishedName] - removed:
property NameAttribute.value -> typing.Union[str, bytes] - changed:
constructor NameAttribute(oid: ObjectIdentifier, value: typing.Union[str, bytes], _type: typing.Optional[_ASN1Type]=…, *, _validate: bool=…) -> None → constructor NameAttribute(oid: ObjectIdentifier, value: str | bytes, _type: _ASN1Type | None=…, *, _validate: bool=…) -> None - changed:
method Name.get_attributes_for_oid(oid: ObjectIdentifier) -> typing.List[NameAttribute] → method Name.get_attributes_for_oid(oid: ObjectIdentifier) -> list[NameAttribute] - changed:
method Name.rfc4514_string(attr_name_overrides: typing.Optional[_OidNameMap]=…) -> str → method Name.rfc4514_string(attr_name_overrides: _OidNameMap | None=…) -> str - changed:
method NameAttribute.rfc4514_string(attr_name_overrides: typing.Optional[_OidNameMap]=…) -> str → method NameAttribute.rfc4514_string(attr_name_overrides: _OidNameMap | None=…) -> str - changed:
method RelativeDistinguishedName.get_attributes_for_oid(oid: ObjectIdentifier) -> typing.List[NameAttribute] → method RelativeDistinguishedName.get_attributes_for_oid(oid: ObjectIdentifier) -> list[NameAttribute] - changed:
method RelativeDistinguishedName.rfc4514_string(attr_name_overrides: typing.Optional[_OidNameMap]=…) -> str → method RelativeDistinguishedName.rfc4514_string(attr_name_overrides: _OidNameMap | None=…) -> str - changed:
static method Name.from_rfc4514_string(data: str, attr_name_overrides: typing.Optional[_NameOidMap]=…) -> Name → static method Name.from_rfc4514_string(data: str, attr_name_overrides: _NameOidMap | None=…) -> Name - added:
property Name.rdns -> list[RelativeDistinguishedName] - added:
property NameAttribute.value -> str | bytes
- removed:
function load_der_ocsp_request(data: bytes) -> OCSPRequest - removed:
function load_der_ocsp_response(data: bytes) -> OCSPResponse - removed:
property OCSPResponse.certificates -> typing.List[x509.Certificate] - removed:
property OCSPResponse.next_update -> typing.Optional[datetime.datetime] - removed:
property OCSPResponse.responder_key_hash -> typing.Optional[bytes] - removed:
property OCSPResponse.responder_name -> typing.Optional[x509.Name] - removed:
property OCSPResponse.revocation_reason -> typing.Optional[x509.ReasonFlags] - removed:
property OCSPResponse.revocation_time -> typing.Optional[datetime.datetime] - removed:
property OCSPResponse.signature_hash_algorithm -> typing.Optional[hashes.HashAlgorithm] - removed:
property OCSPSingleResponse.next_update -> typing.Optional[datetime.datetime] - removed:
property OCSPSingleResponse.revocation_reason -> typing.Optional[x509.ReasonFlags] - removed:
property OCSPSingleResponse.revocation_time -> typing.Optional[datetime.datetime] - changed:
constructor OCSPRequestBuilder(request: typing.Optional[typing.Tuple[x509.Certificate, x509.Certificate, hashes.HashAlgorithm]]=…, request_hash: typing.Optional[typing.Tuple[bytes, bytes, int, hashes.HashAlgorithm]]=…, extensions: typing.List[x509.Extension[x509.ExtensionType]]=…) -> None → constructor OCSPRequestBuilder(request: tuple[x509.Certificate, x509.Certificate, hashes.HashAlgorithm] | None=…, request_hash: tuple[bytes, bytes, int, hashes.HashAlgorithm] | None=…, extensions: list[x509.Extension[x509.ExtensionType]]=…) -> None - changed:
constructor OCSPResponseBuilder(response: typing.Optional[_SingleResponse]=…, responder_id: typing.Optional[typing.Tuple[x509.Certificate, OCSPResponderEncoding]]=…, certs: typing.Optional[typing.List[x509.Certificate]]=…, extensions: typing.List[x509.Extension[x509.ExtensionType]]=…) → constructor OCSPResponseBuilder(response: _SingleResponse | None=…, responder_id: tuple[x509.Certificate, OCSPResponderEncoding] | None=…, certs: list[x509.Certificate] | None=…, extensions: list[x509.Extension[x509.ExtensionType]]=…) - changed:
method OCSPResponseBuilder.add_response(cert: x509.Certificate, issuer: x509.Certificate, algorithm: hashes.HashAlgorithm, cert_status: OCSPCertStatus, this_update: datetime.datetime, next_update: typing.Optional[datetime.datetime], revocation_time: typing.Optional[datetime.datetime], revocation_reason: typing.Optional[x509.ReasonFlags]) -> OCSPResponseBuilder → method OCSPResponseBuilder.add_response(cert: x509.Certificate, issuer: x509.Certificate, algorithm: hashes.HashAlgorithm, cert_status: OCSPCertStatus, this_update: datetime.datetime, next_update: datetime.datetime | None, revocation_time: datetime.datetime | None, revocation_reason: x509.ReasonFlags | None) -> OCSPResponseBuilder - changed:
method OCSPResponseBuilder.sign(private_key: CertificateIssuerPrivateKeyTypes, algorithm: typing.Optional[hashes.HashAlgorithm]) -> OCSPResponse → method OCSPResponseBuilder.sign(private_key: CertificateIssuerPrivateKeyTypes, algorithm: hashes.HashAlgorithm | None) -> OCSPResponse - added:
property OCSPResponse.certificates -> list[x509.Certificate] - added:
property OCSPResponse.next_update -> datetime.datetime | None - added:
property OCSPResponse.responder_key_hash -> bytes | None - added:
property OCSPResponse.responder_name -> x509.Name | None - added:
property OCSPResponse.revocation_reason -> x509.ReasonFlags | None - added:
property OCSPResponse.revocation_time -> datetime.datetime | None - added:
property OCSPResponse.signature_hash_algorithm -> hashes.HashAlgorithm | None - added:
property OCSPSingleResponse.next_update -> datetime.datetime | None - added:
property OCSPSingleResponse.revocation_reason -> x509.ReasonFlags | None - added:
property OCSPSingleResponse.revocation_time -> datetime.datetime | None - added:
variable load_der_ocsp_request - added:
variable load_der_ocsp_response
- added:
variable PolicyBuilder - added:
variable ServerVerifier - added:
variable Store - added:
variable Subject - added:
variable VerificationError